MCP Observatory
4m ago Tracked 39,541 Last 4m ago 24h 3,153
npm JavaScript analyzed 3.38.9 unconfirmed MCP

ruflo

v3.38.9
npm

Ruflo - Enterprise AI agent orchestration platform. Deploy 60+ specialized agents in coordinated swarms with self-learning, fault-tolerant consensus, vector memory, and MCP integration

maintainer
ruvnet
license
MIT
first seen
2026-06-09
last seen
2026-08-14
releases · 30d
60
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v3.38.9 · analyzer v32 · 10h ago

skills & prompt files 2

code evidence v3.38.9 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 291

filesystem 15

  • fs package/bin/ruflo.js :5 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) package/src/mcp-bridge/test-security-lock.js :21 import fs from "node:fs";
  • fs (weak) package/src/ruvocal/scripts/generate-welcome.mjs :16 import { writeFileSync } from "fs";
  • fs (weak) package/src/ruvocal/scripts/populate.ts :23 import fs from "fs";
  • fs (weak) package/src/ruvocal/scripts/setups/vitest-setup-server.ts :4 import fs from "fs";
  • fs (weak) package/src/ruvocal/scripts/updateLocalEnv.ts :1 import fs from "fs";
  • fs package/src/ruvocal/src/lib/server/database.ts :29 import { existsSync, mkdirSync } from "fs";
  • fs (weak) package/src/ruvocal/src/lib/server/database/__tests__/rvf.spec.ts :12 import { existsSync, unlinkSync, readFileSync } from "fs";
  • fs package/src/ruvocal/src/lib/server/database/rvf.ts :17 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
  • fs package/src/ruvocal/src/lib/server/findRepoRoot.ts :1 import { existsSync } from "fs";
  • fs package/src/ruvocal/src/lib/server/router/policy.ts :1 import { readFile } from "node:fs/promises";
  • fs package/src/ruvocal/src/routes/admin/export/+server.ts :6 import { unlink } from "node:fs/promises";
  • fs (weak) package/src/ruvocal/vite.config.ts :3 import { promises } from "fs";
  • fs (weak) package/src/scripts/generate-config.js :15 import { readFileSync, writeFileSync, existsSync } from "fs";
  • fs (weak) package/src/scripts/generate-welcome.js :16 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";

shell / exec 4

  • shell package/src/mcp-bridge/index.js :2 import { spawn } from "child_process";
  • shell (weak) package/src/mcp-bridge/test-runtime-security.mjs :17 import { spawn } from "node:child_process";
  • shell package/src/ruvocal/mcp-bridge/index.js :2 import { spawn } from "child_process";
  • shell (weak) package/src/ruvocal/svelte.config.js :5 import { execSync } from "child_process";

network 32

  • net package/src/mcp-bridge/index.js :675 const resp = await fetch(url, {
  • net package/src/mcp-bridge/mcp-stdio-kernel.js :67 const resp = await fetch(`${BRIDGE_URL}/mcp`, {
  • net (weak) package/src/mcp-bridge/test-harness.js :53 const res = await fetch(`${BASE}${path}`, options);
  • net (weak) package/src/mcp-bridge/test-runtime-security.mjs :92 const r = await fetch(`http://127.0.0.1:${port}/mcp`, {
  • net package/src/ruvocal/mcp-bridge/index.js :685 const resp = await fetch(url, {
  • net package/src/ruvocal/mcp-bridge/mcp-stdio-kernel.js :67 const resp = await fetch(`${BRIDGE_URL}/mcp`, {
  • net (weak) package/src/ruvocal/mcp-bridge/test-harness.js :53 const res = await fetch(`${BASE}${path}`, options);
  • net package/src/ruvocal/src/hooks.server.ts :30 if (building) return input.fetch(input.request);
  • net package/src/ruvocal/src/lib/createShareLink.ts :15 const res = await fetch(`${base}/conversation/${id}/share`, {
  • net package/src/ruvocal/src/lib/server/auth.ts :478 const response = await fetch("https://huggingface.co/api/whoami-v2", {
  • net package/src/ruvocal/src/lib/server/endpoints/openai/endpointOai.ts :81 const response = await fetch(url, init);
  • net package/src/ruvocal/src/lib/server/hooks/fetch.ts :17 return fetch(new Request(request, { headers }));
  • net package/src/ruvocal/src/lib/server/isURLLocal.ts :3 import { isIP } from "node:net";
  • net package/src/ruvocal/src/lib/server/metrics.ts :4 import { createServer, type Server as HttpServer } from "http";
  • net package/src/ruvocal/src/lib/server/models.ts :126 preprompt: m.prepromptUrl ? await fetch(m.prepromptUrl).then((r) => r.text()) : m.preprompt,
  • net package/src/ruvocal/src/lib/server/router/arch.ts :173 const resp = await fetch(`${baseURL}/chat/completions`, {
  • net package/src/ruvocal/src/lib/server/sendSlack.ts :10 const res = await fetch(config.WEBHOOK_URL_REPORT_ASSISTANT, {
  • net package/src/ruvocal/src/lib/server/textGeneration/mcp/runMcpFlow.ts :318 const res = await fetch(input, init);
  • net package/src/ruvocal/src/lib/server/urlSafety.ts :2 import { isIP } from "node:net";
  • net package/src/ruvocal/src/lib/stores/mcpServers.ts :169 const response = await fetch(`${base}/api/mcp/servers`);
  • net package/src/ruvocal/src/lib/stores/settings.ts :63 await fetch(`${base}/settings`, {
  • net package/src/ruvocal/src/lib/utils/loadAttachmentsFromUrls.ts :86 const response = await fetch(proxyUrl);
  • net package/src/ruvocal/src/lib/utils/messageUpdates.ts :73 const response = await fetch(`${opts.base}/conversation/${conversationId}`, {
  • net package/src/ruvocal/src/lib/workers/autopilotWorker.ts :162 const response = await fetch(msg.url, {
  • net package/src/ruvocal/src/lib/workers/detailFetchWorker.ts :57 const res = await fetch(`${msg.bridgeUrl}/autopilot/detail/${msg.detailToken}`);
  • net package/src/ruvocal/src/routes/__debug/openai/+server.ts :8 const res = await fetch(`${base}/models`);
  • net package/src/ruvocal/src/routes/api/fetch-url/+server.ts :3 import { Agent, fetch } from "undici";
  • net package/src/ruvocal/src/routes/api/transcribe/+server.ts :62 const response = await fetch(apiUrl, {
  • net package/src/ruvocal/src/routes/api/v2/debug/refresh/+server.ts :9 const res = await fetch(`${base}/models`);
  • net package/src/ruvocal/src/routes/api/v2/user/billing-orgs/+server.ts :22 const response = await fetch("https://huggingface.co/oauth/userinfo", {
  • net package/src/ruvocal/src/routes/models/[...model]/+page.ts :4 await fetch(`${base}/api/v2/models/${params.model}/subscribe`, {
  • net package/src/ruvocal/static/wasm/rvagent_wasm.js :1531 module_or_path = fetch(module_or_path);

secrets 5

  • secrets package/src/mcp-bridge/index.js :918 const MCP_TOKEN = process.env.MCP_AUTH_TOKEN || "";
  • secrets package/src/mcp-bridge/mcp-stdio-kernel.js :28 const KERNEL_SECRET = process.env.RVF_KERNEL_SECRET || randomUUID();
  • secrets package/src/ruvocal/mcp-bridge/index.js :654 const apiKey = process.env.GOOGLE_API_KEY;
  • secrets package/src/ruvocal/mcp-bridge/mcp-stdio-kernel.js :28 const KERNEL_SECRET = process.env.RVF_KERNEL_SECRET || randomUUID();
  • secrets package/src/ruvocal/src/lib/server/hooks/init.ts :18 process.env.HF_TOKEN ??= canonicalToken;

database 45

  • db (weak) package/src/ruvocal/scripts/populate.ts :8 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/jobs/refresh-conversation-stats.ts :4 import type { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/lock.ts :2 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/routines/01-update-search-assistants.ts :3 import { ObjectId, type AnyBulkWriteOperation } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/routines/02-update-assistants-models.ts :3 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/routines/04-update-message-updates.ts :3 import { ObjectId, type WithId } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/routines/05-update-message-files.ts :1 import { ObjectId, type WithId } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/routines/06-trim-message-updates.ts :3 import { ObjectId, type WithId } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/routines/08-update-featured-to-review.ts :3 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/migrations/routines/09-delete-empty-conversations.spec.ts :4 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/routines/09-delete-empty-conversations.ts :3 import { Collection, FindCursor, ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/routines/10-update-reports-assistantid.ts :3 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/migrations/routines/index.ts :1 import type { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/server/__tests__/conversation-stop-generating.spec.ts :2 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/server/api/__tests__/conversations-id.spec.ts :2 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/server/api/__tests__/conversations-message.spec.ts :2 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/server/api/__tests__/testHelpers.ts :1 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/server/api/__tests__/user-reports.spec.ts :2 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/server/api/utils/resolveConversation.ts :2 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/server/auth.ts :19 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/server/conversation.ts :4 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/server/database/postgres.ts :12 import pg from "pg";
  • db package/src/ruvocal/src/lib/server/endpoints/endpoints.ts :11 import type { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/server/endpoints/preprocessMessages.ts :4 import type { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/types/Assistant.ts :1 import type { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/types/Conversation.ts :1 import type { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/types/MigrationResult.ts :1 import type { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/types/Report.ts :1 import type { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/lib/types/User.ts :1 import type { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/utils/tree/addChildren.spec.ts :2 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/utils/tree/addSibling.spec.ts :2 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/utils/tree/buildSubtree.spec.ts :2 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/utils/tree/convertLegacyConversation.spec.ts :2 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/lib/utils/tree/treeHelpers.spec.ts :2 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/api/conversation/[id]/+server.ts :4 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/api/conversation/[id]/message/[messageId]/+server.ts :4 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/api/v2/conversations/[id]/+server.ts :7 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/api/v2/conversations/[id]/message/[messageId]/+server.ts :7 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/conversation/+server.ts :3 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/conversation/[id]/+server.ts :8 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/conversation/[id]/message/[messageId]/prompt/+server.ts :8 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/conversation/[id]/share/+server.ts :6 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/conversation/[id]/stop-generating/+server.ts :5 import { ObjectId } from "mongodb";
  • db (weak) package/src/ruvocal/src/routes/login/callback/updateUser.spec.ts :5 import { ObjectId } from "mongodb";
  • db package/src/ruvocal/src/routes/login/callback/updateUser.ts :7 import { ObjectId } from "mongodb";

install hooks 2

  • prepublishOnly package/package.json :27 node scripts/prepare-publish.mjs
  • prepare package/src/ruvocal/package.json :19 husky

declared dependencies 1

  • @claude-flow/cli@^3.33.0

perm:untrusted 1

  • untrusted package/src/ruvocal/src/lib/server/models.ts :126 preprompt: m.prepromptUrl ? await fetch(m.prepromptUrl).then((r) => r.text()) : m.preprompt,